Security Policy Errors

How to Fix Whitelisted Sender Going to Quarantine in Microsoft 365

Maira Mehtab Sep 21, 2026 869 views

Question details

A user needs to understand and resolve an issue where emails from a whitelisted vendor are still being sent to quarantine in Microsoft 365.

Product: Microsoft 365
Device & OS: not provided
Scenario: Receiving emails from a trusted vendor whose address and domain have already been added to the inbound spam policy allow list.
Observed behavior: Some messages are delivered successfully, but others continue to bypass the allow list and go straight to quarantine.

Before you start

Ensure you have global administrator or security administrator permissions in Microsoft 365 to access the quarantine details and message trace tools.

Solution 1Recommended

Review Message Trace and Quarantine Details

Identify exactly which policy or rule is routing the allowed messages to quarantine.

Even if a sender is on the spam policy allow list, other filtering layers like transport rules, high-confidence phishing protection, or user-level safe sender settings can override the global allow list.

Access Quarantine Details

Go to the Microsoft 365 Defender portal and navigate to Email & Collaboration > Review > Quarantine. Select the affected message to view the quarantine reason (e.g., High Confidence Phishing).

Run a Message Trace

Open the Exchange Admin Center, go to Mail Flow > Message Trace, and run a trace on the affected emails to identify any transport rules or conflicting policies acting on the message.

Secure by Default: Microsoft 365's 'secure by default' policy prevents high-confidence phishing and malware from bypassing quarantine, even if the sender is whitelisted.

Solution 2

Account for Propagation Delays

Wait for allow-list policy changes to fully replicate across Microsoft 365 servers.

Solution 3

Contact Microsoft Support

Escalate the issue to Microsoft 365 support if the cause cannot be identified via message trace.

Free Microsoft Office alternative

Looking for a Lightweight Microsoft Office Alternative?

While you are managing Microsoft 365 admin settings, you might also be looking for a fast, free, and highly compatible office suite for your daily document needs. WPS Office offers a seamless alternative with comprehensive word processing, spreadsheet, and presentation tools.

1. Download WPS Office: Visit the official WPS website and download the installation package for your operating system.
2. Install the Application: Run the installer and follow the on-screen instructions to complete the setup.
3. Start Creating: Open WPS Office and instantly start working on your documents, spreadsheets, and presentations.

Fully compatible with Microsoft Office formats (.docx, .xlsx, .pptx)Free and lightweight, consuming fewer system resourcesFamiliar user interface for a zero-learning-curve migrationBuilt-in PDF editor and AI-powered writing assistance

microsoft office alternative - wps office

Frequently Asked Questions

Can a transport rule override the spam policy allow list in Microsoft 365?

Yes, Exchange transport rules (mail flow rules) process messages before standard spam filtering policies. If a transport rule is configured to send certain messages to quarantine based on specific conditions, it will override the spam policy allow list.

Why are high-confidence phishing emails quarantined despite being whitelisted?

Microsoft 365 operates on a 'secure by default' philosophy. This means that if the system's filtering layers assign a high-confidence phishing or malware verdict to an email, that verdict cannot be bypassed by an inbound spam policy allow list.

How long does it take for an updated spam policy to take effect?

While policy updates typically take effect quickly, standard replication across Microsoft 365 global environments can occasionally experience delays. It is best practice to allow up to 24 hours for policy changes to fully propagate.

Microsoft Office Security Issues